That should have nothing to do w/ IPSEC - these are ports that need to be opened in the windows firewall. ports 139 and 445 need to be open for the agent installer job to copy the rscd installer to the target and execute it. port 4750 is the port the appserver used to communicate w/ the agent.

we shouldn't be using port 3598 - why did you see that needed to be open ?

Thanks for the reference and clarity on the ports to open up. We saw communication between the app server and target host using netstat. But thank you for the input and we will make sure we only open up the correct ports. The challenge is that not all the servers are in the same OU and with older systems its not so easy to push a GPO down from AD. We have about another 500 windows we have to install BSA on for the first time and it's not easy.